System and method for dynamically grouping devices based on present device conditions

ABSTRACT

A method to dynamically group devices based on device information, which is associated with a system for monitoring the device information that communicates information between a device and an enterprise. Information is collected from a device information source to obtain an actual status of a device. The actual status of the device is compared to a stored status of the device. The stored status is stored on a server of the enterprise. The enterprise determines if the actual status has been changed from the stored status. When a change is detected, the method performs at least one of the acts of automatically disassociating the device from a group that reflects the stored status and automatically associating the device with a new group to reflect the actual status.

CROSS-REFERENCE TO RELATED APPLICATIONS

Not Applicable.

BACKGROUND

Field of the Art

The present disclosure generally relates to monitoring devices and, more particularly, to dynamically grouping devices based on present device conditions.

Background and Relevant Art

Device manufacturers have typically created hierarchical groups of data to organize the network environment based on criteria such as geography, customer base, service organization, or other similar information that has been used to identify the groups. Earlier, the grouping was created either manually or based on statically entered information about the device. Recent systems have started to use existing parameters to automatically group computing devices based on criteria, such as response time, items in a given group, or transmission distance.

A system for dynamically grouping computing devices is disclosed in U.S. Patent Application Publication No. 2005/0193099 to Reus et al. The computing device transmitted a query and received a response including a neighbor-casting group. The group was selected based on predetermined criteria from the computing device. The criteria included the number of computing devices in the selected group, the amount of time between the query and the response from the selected group, or a combination of the number and time. The computing device could select one other group, remove itself from a group, or join the other selected group. The groups are automatically maintained as other devices are added to and removed from a domain or local area network so that no group grows inappropriately large. The group selection focuses solely on response time and number of computing devices in the system.

In a system disclosed in U.S. Pat. No. 7,079,010 to Champlin, information technology was monitored. The system included a monitor agent that was configured to collect performance and availability metrics associated with a host machine, a network, an operating system, a database or an application. The metrics were transferred to a data loader by the monitor agent. The monitor agent would generate alerts, which were sent to an escalation server. The alerts received by the escalation server could be grouped based on the metric type. The metrics were compared to configured alert thresholds to generate two types of alerts—a “warning” condition and a “critical” condition. The grouping was static, however, and did not adjust when the status of the information technology changed.

International publication number WO/2006/009402 to NHN Corp. disclosed an event alerting system and a method dynamically grouping for an event alert. An event message was sent to a client when an event was generated by the client or an alerting server. The clients were grouped according to transmission distance to the client by the alerting server. A client list and an alerting data packet were transmitted to master clients selected by the grouping process. The client list and data packet were also transmitted to a master client of an upper group to the last layer, which was established by performing the grouping process again. The groups are dynamically arranged from a generated list based on the transmission distance in each process of grouping the alerts.

In U.S. Patent Application Publication No. 2006/0200494 to Sparks, a distributed computing system is disclosed that conforms to a multi-level, hierarchical organizational model. Control nodes provide automated allocation and management of computing functions and resources within the distributed computing system in accordance with the organization model. The model includes four distinct levels: fabric, domain, tiers, and nodes. These levels provide for logical abstraction and containment of physical components as well as system and service application software of the enterprise. An administrator interacts with the control nodes to logically define the hierarchical organization of the distributed computing system. The control node detects the node added to the network and automatically identifies attributes for the detected node. This system, however, does not dynamically group devices based on changes associated with the device.

Related technologies have used systems that group devices in various areas. For example, remote device management systems have been used to create hierarchical groupings for such things as device access (authorization), alert escalation, bulk device operations (e.g., content distribution and communication scheduling), and business workflow management.

The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that operate only in environments such as those described above. Rather, this background is only provided to illustrate one exemplary technology area where some embodiments described herein may be practiced.

BRIEF SUMMARY OF THE INVENTION

In a system for monitoring device information that communicates information between a device and an enterprise, a method is provided for dynamically grouping the device. The process collects information from a device information source to obtain an actual status of a device. The process compares the actual status of the device to a stored status of the device. The stored status is stored in a database of the enterprise. In the enterprise, the process determines if the actual status has been changed from the stored status. When the change is detected, the device is automatically disassociated from groups that reflect the stored status and/or automatically associates with new groups to reflect the actual status.

In another aspect of the invention, a method for dynamically grouping devices is provided in a system for monitoring device information that communicates information between a device and an enterprise. At least one of a new software and hardware is installed to the device. Information is collected from a device information source to obtain an actual status of the device. The device is automatically associated with groups to link the device to a defined rule.

In a further aspect of the invention, a system for dynamically grouping devices is associated with a monitor agent that monitors a device. The system includes a server that communicates with the device. The device is configured to collect information to obtain an actual status of the device. The system also includes an enterprise that is configured to compare the actual status of the device to collected information previously stored on the device and to determine whether the actual status has been changed from the stored status. When the actual status is changed, the device is automatically disassociated from groups that reflect the stored status and/or automatically associated with new groups to reflect the actual status.

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

Additional features and advantages will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the teachings herein. Features and advantages of the invention may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. Features of the present invention will become more fully apparent from the following description and appended claims, or may be learned by the practice of the invention as set forth hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to describe the manner in which the above-recited and other advantages and features can be obtained, a more particular description of the subject matter briefly described above will be rendered by reference to specific embodiments which are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments and are not therefore to be considered to be limiting in scope, embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:

FIG. 1 illustrates a system for dynamically grouping devices in accordance with the various embodiments of the present invention;

FIG. 2 is a flowchart illustrating a method of dynamically grouping devices in accordance with one exemplary embodiment;

FIG. 3 is a flowchart illustrating a method of dynamically grouping devices and deleting empty groups in accordance with one exemplary embodiment; and

FIG. 4 is a flowchart illustrating a method of evaluating rules associated with groups in accordance with one exemplary embodiment.

DETAILED DESCRIPTION OF THE INVENTION

The present system and method includes various embodiments of dynamically grouping devices based on present device conditions. Software has been developed to monitor the running conditions, wearing components, break down and maintenance conditions, and the like in many different devices. These devices are usually monitored individually. For example, when the toner level in a copier is low, a warning is displayed on the unit.

Other devices, such as medical equipment, computers, pumps, and compressors, to name a few, are also monitored continually. In the present invention, the device can include any system or apparatus in which data is collected. The users typically observe the information received from the device, interact with it, and/or perform actions using the system associated with the device. Some actions may include: service actions, sales events, research and development, performance tracking, and other events related to the device. This collected information can be voluminous and hard to track, especially when hundreds or thousands of devices are being tracked by an enterprise.

The present invention dynamically groups these devices into specific categories and tracks a device based on rules that are established by the users. The device includes a monitor agent that actively monitors and collects information. When the device meets a defined rule, the device communicates with the enterprise. The enterprise takes action once data is received from the device. The device can communicate with the enterprise intermittently, at a given time, or when an event occurs. The communication between the device and the enterprise occurs remotely over the global computer network or through a local network. The device can generate a notification, such as an alarm or alert. When a condition to a rule is met, a notification can be sent to a group hierarchy. The enterprise evaluates rules when a change in the status of a device is received.

The devices are grouped based on certain criteria, such as geography, software application, version, extension, device type, model number, installation, division, or other device parameter. A device can be added or removed from a given group dynamically without requiring input from any user. The movement in and out of groups can occur when an event triggers the group evaluation, such as (a) after device registration or profile updates, (b) when receiving new device operational, status, environmental data, (c) when receiving new configuration information (i.e. new versions), or (d) when alarms and/or alerts are created for a device. These groups are created automatically and may define where notifications are sent and associate other business logic to devices, such as data collection schedules, software/patch distribution schedules, and the like. The groups are arranged or created such that an administrator is no longer required review each device to verify present device conditions.

The devices are associated with defined groups in the system, which creates many advantages. For example, groups help organize the devices so users can locate the device easily. In addition, “bulk” operations can be performed on multiple devices. These operations, for instance, include: data collection, such as data readings, configuration information, file transfers, and the like; and software updates. The groups can also control escalation of alert notifications. Furthermore, they can be used to control access to devices, for example, which users can view or change information regarding certain devices.

In the embodiments of the invention, the system includes an enterprise system 100 that communicates with at least one device 200 through a local or global computer network 300, such as the Internet, World Wide Web, or other similar network. The enterprise system 100 includes a server 110 that is connected to a database 120. The device 200 communicates with the enterprise 100 at predefined intervals. The device, for instance, can include a power meter, MRI machine, printing press, X-Ray machine, or other devices that include, or can be adapted to include, a monitor agent. These devices may vary in complexity and may have a set of subsystems associated with them.

The device 200 contains or is connected through a serial port, USB, network, or the like to a monitor agent 220. The monitor agent 220 is configured to monitor the device status and verify that the device is properly functioning and maintained. The monitor agent 220 communicates device information to the enterprise 100 as requested by enterprise users or when monitored conditions are met, as defined by rules. The rules can include monitoring rules, which are set up by the user in the monitor agent 220 on the device side, or dynamic group rules, which are set up by the enterprise user to monitor an active status of the devices that belong to the defined group. The status includes operational status, data readings, or configuration of the device.

The server 110 in the enterprise system 100 interacts with the monitor agent 220 to communicate the collected data from the monitor agent 220 to the enterprise system 100. When the data collected from the devices 200 meet a specified condition, a notification or set of notifications 400 can be created by the monitor agent 220 or the enterprise system 100 as discussed in further detail below. The notifications 400 can be sent to recipients inside or outside the local network associated with the device 200.

Other devices 500 can be connected to the enterprise system 100 through the global computer network 300 or other local network. The devices 500 are represented as systems 2 through n to mean any defined amount of devices, which can meet, but not exceed, the capacity of the enterprise system 100. As the users' needs grow, the enterprise system 100 can be modified to match the users' needs, for example, by adding more bandwidth, servers, and/or database capacity. Each of the other user systems 500 includes similar components as those defined in the device 200.

The monitor agent 220 collects information from the sources of device data, such as a database, a registry, the file system, or data collection protocols. The type of data can include various classes of information including: monitoring data, usage data, and configuration data. This data, for example, can include the operational status, operational data, usage information, location information, environmental information, SW/HW version information (i.e. “configuration” information), or any data available on the device that can be communicated to the enterprise 100. To collect the data, the monitor agent 220 uses plug-in modules to collect device information using either standard or device-proprietary methods. The monitor agent 220 sends data to the enterprise using Web services. The software is not limited to a specific protocol such as simple mail transfer protocol (SMTP) or hypertext transfer protocol (HTTP) but may be adapted to any protocol known by one skilled in the art for data interchange at the hardware device level or at application program level.

The administrator reviews the type of information to set up monitoring rules that interact or perform actions with respect to the device and track current device parameters. The administrator can also set up dynamic group rules at the same time. These rules are based on business logic and can be changed and modified at any time, which will be discussed later in more detail below. The monitor agent software is used to collect data that can be used to locally monitor the data and evaluate the monitoring or dynamic group rules, or sent to the enterprise where it can be monitored and trigger other processing, like dynamic grouping.

Once the plug-in modules are integrated with the monitor agent 220, the status of the device is checked against the dynamic group rules and monitoring rules. During the process, the data from the device also triggers dynamic grouping in the system. The device can be evaluated at a triggering event, at a specific time, after updates or revisions, at the user's request, or at other prescribed intervals. The monitor agent 220 sends data sets of information to an enterprise server at the time of the triggering event and just before and after the event to capture the condition of the device. The data can also be collected at a specific time, such as every evening or at the close of business. Each time the device is updated or software revisions are installed, the data also can be collected. If the user needs information outside the prescribed times, a user request can be sent at any time. For instance, if a user wants to verify the configuration of the device and does not want to wait for a prescribed time, a request can be sent immediately.

The communication between the monitor agent 220 and the enterprise 100 can be rejected due to firewalls, NAT, etc. that are implemented to block unwanted communication. The system can use a “polling server” model to enhance the ability to communication between the device and the enterprise if needed. The “polling server” model is discussed, for example, in U.S. Patent Publication No. 2003/0118353 entitled Method and Apparatus for Managing Intelligent Assets in a Distributed Environment, which is hereby incorporated by reference in its entirety.

A group hierarchy is created. The group hierarchy can include dynamically and statically defined groups, where dynamic group hierarchies start at a statically defined root group. A dynamically defined group is a group to which devices are assigned automatically. To set up a dynamic group, the user defines it by setting up criteria against which the devices are evaluated to determine their membership in the group. The statically defined group is a group whose device membership has been manually defined by an administrator. The administrator creates the group and associates devices with it. When a new device is added to the system, the administrator manually associates it with a static group. The dynamic hierarchical groups are created based on analysis of dynamic group rules and information collected directly from the device.

A dynamic group rule can be created to specify how devices will be automatically organized into groups when those devices are manually created or provide information to the enterprise. Devices can be automatically associated with groups based on a set of rules or some aspect of their profiles. As devices are added to the system or provide updated information to the enterprise, they are automatically associated with the applicable dynamic groups. A dynamic group rule causes groups to be created. The first time a device is found to match the membership criteria for a dynamic group that group is created. The static and dynamic groups have a parent group. Those at the top level have a special built-in logical parent are called a root. Groups whose parent is the root are called root groups.

Automatic groupings can be created based on device configuration data. For example, the group can be defined from the software, firmware, hardware revision information, as well as other actual configuration information. The groups are matched with configuration baselines defined on the enterprise system 100.

The groups can also be automated based on extended and configurable registration information. The information, for example, can include device location, such as country, state, city, building, etc., or other customer information, like company name, group, responsible party, and other identifying information.

Business rules can also be applied at the device or the enterprise. The device can be grouped according to the business rule. For example, devices can be grouped based on a dynamic device property exceeding a threshold, such as a temperature, duration, pressure, or the like. If the collected information of the device meets a monitoring rule, then information can be sent to the enterprise where the system evaluates the collected information for dynamic group evaluation. The addition and removal of devices to and/or from groups manages the group-based business logic. The group-based business logic is disassociated from a group when the device is automatically disassociated from the group and group based business logic is associated to a new group when the device is automatically associated with the new group.

Automatic grouping also can be based on a device condition, such as an alert or an alarm. Alarms can be created by the monitor agent or by the enterprise system that monitors rules. When an alarm or alert is created, it triggers dynamic group rule evaluation. Alarms and alerts are defined by rules or business logic, which will be discussed below. The devices that are in a specified alert state, that is, meet a condition defined by a rule, can all be grouped together. The notifications of such a condition can be sent out to recipients, such as field service technicians, device operators, etc. on a group level when the devices are grouped based on a specific alert state. Business logic can also be applied to groups. The business logic is applied to or removed from devices that enter or leave a dynamic group, respectively.

A dynamic group rule can create a hierarchy of groups, not just one flat group. A device can belong to multiple groups and subgroups in the hierarchy. The user selects which static groups to associate with the device or creates a rule specifying the device data that should be used to match the current device conditions. During the selection process, for instance, the user may choose to group the device by location, device type, and software application. The device location may be a high level group, which includes many other device types. Thus, the device type group becomes a subgroup of the device location group. Likewise, different software application groups may be found in the device type group making it a subgroup of the device type group. This relationship creates a hierarchy of groups and subgroups—the subgroups being defined within another group. Some groups may be entirely defined within a group while others may be partially defined within the group. The hierarchical groups are defined accordingly for each device.

The devices are initially defined within hierarchical groups but the groups can dynamically change over time. In addition to device information changing, the dynamic group rule can change, which also changes the group membership. An exemplary embodiment of the process is found in FIG. 2. This process can be applied when the information is collected from the device, for example, when the device is initially installed or some other event occurs. The process of dynamic grouping starts by receiving device information from the monitor agent at step S20. The process then proceeds to step S21 where the actual status of the device is compared against the stored status. If the status of the device or the group rule has changed, then it proceeds to the next step S22. In step S22, the device information is evaluated for dynamic group membership. Then, the enterprise system in step S23 checks whether an existing group has been defined for the change in status of the device or the rule. If a group does not exist for the group, then a new group is created in step S24. For example, if the software application was version 3.0 but was updated to version 3.1 and a group for version 3.1 has not been created, then a new version 3.1 group is created. Next, the device is associated with the new group created in step S24 and disassociated from the outdated group in step S25. Continuing from the previous example, the device is associated to the version 3.1 group and disassociated from the version 3.0 group. If the device status or the group rule has not changed in step S21, then the process ends.

Rules can be set up at the group level to send a notice when a condition is met. For example, a rule can be created to notify the group when a temperature of a device exceeds a limit. Another rule can be set for the device when the temperature goes below a limit. Each rule is created based on the user's needs and what criteria the user wishes to monitor for a given device.

Continuing with the process in FIG. 2, if a group already exists for the defined group in step S23, then the process goes to step S25 where the device is associated with the new existing group and disassociated from the outdated group. Then the process ends.

A group can be deleted if it is empty. Alternatively, the user can choose to maintain the group, for example, if the user intends to reinstall the device or application that would use the group at some point. FIG. 3 illustrates an automated process for deleting empty groups. In step S30, device information is received that triggers dynamic rule evaluation. The enterprise system then disassociates the device from a corresponding group or set of groups in step S31. Once the system completes the evaluation and has updated the device groups, the enterprise system checks for any empty groups in step S32. If the group is empty, the enterprise system automatically deletes the group in step S33. If the disassociated group is not empty, then the process ends.

The monitor agent communicates over the global computer network, such as the Internet, with a server in the enterprise system. The system can use, for example, extensible markup language (XML) or any other known format to communicate in a common language.)ML is flexible and can create common information formats to share between the device and the enterprise system in a consistent way.

In one embodiment of the present invention, the notifications are defined as alarms and alerts. The alarm is a notification that is sent when a condition exists. For example, an alarm can be triggered when the temperature of the device exceeds a preset limit. The alarm is tracked and stored in a database. An alert is a notification of a recommended or required action based on a condition. One alarm can generate multiple alerts.

In an alternative embodiment, the notifications can escalate. After a notification has been sent to a group, if it has not been acknowledged within a defined time limit, then the notification is escalated to the next higher-level group in the hierarchy. And if the notification is not acknowledged on the higher level, then it is escalated to the next group and so forth. If the notification is acknowledged within the defined time limit, then it will not escalate to the next group. The time limit can be any defined amount of time. Typically, the time limit is defined in hours. In one example, the time limit may be set between three and five hours from the notification. The selection of a time limit is not limited to any particular range since it is based on user input.

FIG. 4 illustrates an exemplary embodiment of the notification escalation. First, the data that is collected from the device is evaluated and compared against the user defined rules, including monitoring rules and dynamic group rules, in step S40. In step S41, the process determines whether the collected data meets a condition of the rule. If it does, an alarm or alert is sent to the group hierarchy in accordance with the defined rule in step S42. The information is tracked and stored in a database for later reference. Next, the process checks whether there are any additional rules to be evaluated in step S43. If so, the process is advanced to the next rule in step S44, which is compared in step S40. If the condition is not met in step S41, then it goes to step S43 to check if any additional rules exist. If there are no additional rules in step S43, then the process ends.

The enterprise system 100 can include the various embodiments discussed above. The information collected from the devices is managed through the enterprise system 100 to reduce the administrative time it take to monitor each device individually. The system groups the devices based on collected information into a group hierarchy. The groups are dynamically created to cut down the amount of time it takes a user to manually create, modify, or delete groups of devices. The rules are created at the group level to track updates, revisions, maintenance issues, and/or other modifications that should be or have been completed on each of the devices.

The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope. 

1-21. (canceled)
 22. A method performed by a server, the method comprising: receiving information from a monitoring agent associated with a device that is monitored; identifying an event associated with the device based on the information; performing a group evaluation in response to the identifying the event; associating the device with a group based on the group evaluation, the device being associated with the group automatically based on one or more predefined rules, the group containing multiple devices including the device that is monitored; and performing, over a computer network, a bulk operation on the multiple devices, the bulk operation comprising sending data to, or receiving data from, the multiple devices.
 23. The method of claim 22, wherein the information is from a time prior to the event, from a time of the event, and from a time following the event.
 24. The method of claim 22, wherein the data comprises a software update, and the bulk operations comprise sending the software update to each of the multiple devices.
 25. The method of claim 22, wherein the data comprises configuration data, and the bulk operations comprise sending the configuration data to each of the multiple devices.
 26. The method of claim 22, wherein the data comprises readings, and the bulk operations comprise obtaining the readings from each of the multiple devices.
 27. The method of claim 22, further comprising: polling the monitoring agent; wherein the information is received in response to the polling.
 28. The method of claim 22, wherein the group is part of a hierarchy of groups, the device belonging to multiple groups in the hierarchy of groups.
 29. The method of claim 22, wherein the group is part of a hierarchy of groups, the hierarchy of groups comprising one or more groups that are defined statically and one or more groups that are defined dynamically, the group being among the one or more groups that are defined dynamically.
 30. The method of claim 22, wherein the information comprises a status of the device, and the event comprises the status meeting a predefined condition.
 31. The method of claim 22, further comprising: outputting notification based on a condition of the device.
 32. The method of claim 31, wherein the notification comprises an alarm indicative of an existence of the condition, and one or more alerts that are based on the alarm, the one or more alerts identifying an action to take based on the condition.
 33. The method of claim 31, further comprising: storing data representing the notification in a database that tracks information about the device.
 34. The method of claim 31, further comprising: waiting, for a time, for acknowledgement of the notification; and absent acknowledgement of the notification within time, escalating the notification within a hierarchy.
 35. Non-transitory computer-readable storage storing instructions that are executable on at least one server, the instructions for performing operations comprising: receiving information from a monitoring agent associated with a device that is monitored; identifying an event associated with the device based on the information; performing a group evaluation in response to the identifying the event; associating the device with a group based on the group evaluation, the device being associated with the group automatically based on one or more predefined rules, the group containing multiple devices including the device that is monitored; and performing, over a computer network, a bulk operation on the multiple devices, the bulk operation comprising sending data to, or receiving data from, the multiple devices.
 36. The non-transitory computer-readable storage of claim 35, wherein the information is from a time prior to the event, from a time of the event, and from a time following the event.
 37. The non-transitory computer-readable storage of claim 35, wherein the data comprises a software update, and the bulk operations comprise sending the software update to each of the multiple devices.
 38. The non-transitory computer-readable storage of claim 35, wherein the data comprises configuration data, and the bulk operations comprise sending the configuration data to each of the multiple devices.
 39. The non-transitory computer-readable storage of claim 35, wherein the data comprises readings, and the bulk operations comprise obtaining the readings from each of the multiple devices.
 40. The non-transitory computer-readable storage of claim 35, wherein the operations comprise: polling the monitoring agent; wherein the information is received in response to the polling.
 41. The non-transitory computer-readable storage of claim 35, wherein the group is part of a hierarchy of groups, the device belonging to multiple groups in the hierarchy of groups.
 42. The non-transitory computer-readable storage of claim 35, wherein the group is part of a hierarchy of groups, the hierarchy of groups comprising one or more groups that are defined statically and one or more groups that are defined dynamically, the group being among the one or more groups that are defined dynamically.
 43. The non-transitory computer-readable storage of claim 35, wherein the information comprises a status of the device, and the event comprises the status meeting a predefined condition.
 44. The non-transitory computer-readable storage of claim 35, wherein the operations comprise: outputting notification based on a condition of the device.
 45. The non-transitory computer-readable storage of claim 44, wherein the notification comprises an alarm indicative of an existence of the condition, and one or more alerts that are based on the alarm, the one or more alerts identifying an action to take based on the condition.
 46. The non-transitory computer-readable storage of claim 44, wherein the operations comprise: storing data representing the notification in a database that tracks information about the device.
 47. The non-transitory computer-readable storage of claim 44, wherein the operations comprise: waiting, for a time, for acknowledgement of the notification; and absent acknowledgement of the notification within time, escalating the notification within a hierarchy.
 48. A system comprising: at least one server; and non-transitory computer-readable storage storing instructions that are executable on the at least one server, the instructions for performing operations comprising: receiving information from a monitoring agent associated with a device that is monitored; identifying an event associated with the device based on the information; performing a group evaluation in response to the identifying the event; associating the device with a group based on the group evaluation, the device being associated with the group automatically based on one or more predefined rules, the group containing multiple devices including the device that is monitored; and performing, over a computer network, a bulk operation on the multiple devices, the bulk operation comprising sending data to, or receiving data from, the multiple devices. 